&write_expire and sets

Zeek
1

Hi guys,

I was wondering what the semantics of &write_expire are for sets. For
example, in trw.bro I see

  global scan_sources: set[addr] &write_expire = 1 day;

The CHANGES file says that a *table* entry will be deleted if an entry
isn't written to within the specified timeframe. Sets obviously don't
have anything that can be written to other than the keys themselves, so
for sets, I presume write_expire means that an entry has to be re-
entered within the timeframe to avoid deletion?

Cheers,
Christian.

2

Oops, sorry, forgot to reply to this question. So, in case this is
still unclear, the answer is: yes (with reentering meaning not to
explicitly delete it first).

Robin